The keeper of the keys for every AI agent.
Bursar gives every AI agent a cryptographic identity, brokers its access, and keeps the ledger — built on the same zero-trust fabric that secures critical infrastructure for cities, banks, and defense.
- ◆Certificate-based mTLS identity
- ◆Free tier for developers
- ◆Up and running in minutes
Agent access ledger
build-agent · cert issued
mTLS · SHA-256 · expires 90d
research-agent · scoped access
MCP · read-only · finance-db
unknown-agent · no identity
no cert · fail-closed
$ claude mcp add bursar -- npx -y @blacksandscyber/mcp-server-bursar
✓ MCP server registered — 14 tools ready
One zero-trust fabric. Three products.
Broker
Zero-trust connectivity
Identity-based software-defined connectivity. Invisible networks, point-and-click access grants, no VPN exposure.
Bouncer
DNS security
Encrypted DNS with live threat blocking. Stops ransomware and malware callbacks at the resolver, per identity.
Bursar
AI agent security
Identity, brokerage, and ledger for AI agents and MCP servers. Self-serve — start free, scale by tier.
Separation of Powers architecture
No single system can grant access alone.
Authorization, management, and connection are split across three independent planes. Compromise one and you still get nothing — every request needs a live certificate, a live grant, and a live path.
See how it worksAuthorizer
Decides who may connect — live, fail-closed, revocable in seconds.
Manager
Global real-time view of every connection, point-and-click grants.
Receiver
Terminates the encrypted point-to-point session — nothing else is reachable.
99%
reduction in connectivity cost & risk vs. VPN
mTLS
certificate identity on every connection — human or agent
W5
who, what, when, where, why — real-time audit in syslog
SBIR
2024 U.S. Air Force Phase 1 SBIR & STTR winner
Recognized, repeatedly
Proven where it's hardest
Built for critical infrastructure.
Federal & Defense
Zero-trust mandate, met
Certificate-based access for DoD and federal programs — from SBIR/STTR research to operational networks.
Smart Cities
Vendor access to city OT
Remote vendors reach exactly one water-treatment PC — not the network — without added IT headcount.
Banking
Branch-level vendor access
ATMs, building systems, and local servers — connected point-to-point, up to 99% cheaper than VPN.
For developers
Secure your agents today.
Sign up, install the MCP package, and your first agent has a working certificate identity in minutes. Free tier included.
Start freeFor enterprises & MSSPs
Run it as a service.
Multi-tenant isolation, wholesale channel pricing, and automated tenant provisioning — built for partners who operate security for others.
Talk to an expert